Sequential detection of transient changes in stochastic-dynamical systems

This paper deals with the problem of detecting transient changes in stochastic-dynamical systems. A statistical observation model which depends on unknown system states (often regarded as the nuisance parameter) is developed. The negative impact of nuisance parameter is then eliminated from the observation model by utilizing the invariant statistics. The Variable Threshold Window Limited CUmulative SUM (VTWL CUSUM) test, previously developed for independent observations, is adapted to the novel observation model. Taking into account the transient change detection criterion, minimizing the worst-case probability of missed detection subject to an acceptable level of the worst-case probability of false alarm within a given time period, the thresholds of the VTWL CUSUM test are optimized. It is shown that the optimized VTWL CUSUM algorithm is equivalent to the Finite Moving Average (FMA) detection rule. A numerical method for estimating the probability of false alarm and missed detection is proposed. The theoretical results are applied to the problem of cyber/physical attack (stealing water from a reservoir) detection on a simple Supervisory Control and Data Acquisition (SCADA) water distribution system.

[1]  Roy S. Smith,et al.  A Decoupled Feedback Structure for Covertly Appropriating Networked Control Systems , 2011 .

[2]  George V. Moustakides,et al.  Multiple Optimality Properties of the Shewhart Test , 2014, 1401.3408.

[3]  Michèle Basseville,et al.  Detection of abrupt changes: theory and application , 1993 .

[4]  Y. Ritov.  Decision Theoretic Optimality of the Cusum Procedure , 1990 .

[5]  Roy L. Streit,et al.  Detection of random transient signals via hyperparameter estimation , 1999, IEEE Trans. Signal Process..

[6]  G. Moustakides.  Optimal stopping times for detecting changes in distributions , 1986 .

[7]  M. Pollak.  Optimal Detection of a Change in Distribution , 1985 .

[8]  T. Lai.  SEQUENTIAL ANALYSIS: SOME CLASSICAL PROBLEMS AND NEW CHALLENGES , 2001 .

[9]  A. Tartakovsky.  Asymptotic Performance of a Multichart CUSUM Test Under False Alarm Probability Constraint , 2005, Proceedings of the 44th IEEE Conference on Decision and Control.

[10]  M. Basseville,et al.  Sequential Analysis: Hypothesis Testing and Changepoint Detection , 2014 .

[11]  Peter Schoo,et al.  Infiltrating Critical Infrastructures with Next-Generation Attacks W32.Stuxnet as a Showcase Threat , 2010 .

[12]  Igor V. Nikiforov,et al.  Detecting an abrupt change of finite duration , 2012, 2012 Conference Record of the Forty Sixth Asilomar Conference on Signals, Systems and Computers (ASILOMAR).

[13]  A. Willsky,et al.  A generalized likelihood ratio approach to the detection and estimation of jumps in linear systems , 1976 .

[14]  I. Nikiforov,et al.  Reliable detection of faults in measurement systems , 2000 .

[15]  V. Veeravalli,et al.  Bayesian Quickest Transient Change Detection , 2010 .

[16]  Alvaro A. Cárdenas,et al.  Attacks against process control systems: risk assessment, detection, and response , 2011, ASIACCS '11.

[17]  T. Lai.  Sequential changepoint detection in quality control and dynamical systems , 1995 .

[18]  I. Nikiforov,et al.  Sequential Detection of Transient Changes , 2012 .

[19]  E. S. Page.  CONTINUOUS INSPECTION SCHEMES , 1954 .

[20]  S. Shankar Sastry,et al.  Understanding the physical and economic consequences of attacks on control systems , 2009, Int. J. Crit. Infrastructure Prot..

[21]  A. Shiryaev.  On Optimum Methods in Quickest Detection Problems , 1963 .

[22]  Peter Willett,et al.  Some methods to evaluate the performance of Page's test as used to detect transient signals , 1999, IEEE Trans. Signal Process..

[23]  Blaise Kevin Guepie,et al.  Détection séquentielle de signaux transitoires : application à la surveillance d'un réseau d'eau potable. (Sequential detection of transient signals : application to the monitoring of drinking water supply network) , 2013 .

[24]  V. G. Repin.  Detecting a signal with unknown moments of appearance and disappearance , 1991 .

[25]  Florian Dörfler,et al.  Attack Detection and Identification in Cyber-Physical Systems -- Part II: Centralized and Distributed Monitor Design , 2012, ArXiv.

[26]  Mitra Fouladirad,et al.  Optimal statistical fault detection with nuisance parameters , 2005, Autom..

[27]  Peter Willett,et al.  Detection of hidden Markov model transient signals , 2000, IEEE Trans. Aerosp. Electron. Syst..

[28]  Santa Barbara,et al.  Secure Control Systems: A Control-Theoretic Approach to Cyber-Physical Security , 2012 .

[29]  S. W. Roberts.  A Comparison of Some Control Chart Procedures , 1966 .

[30]  G. Lorden.  PROCEDURES FOR REACTING TO A CHANGE IN DISTRIBUTION , 1971 .

[31]  Tze Leung Lai,et al.  Information Bounds and Quick Detection of Parameter Changes in Stochastic Systems , 1998, IEEE Trans. Inf. Theory.

[32]  G. Moustakides,et al.  State-of-the-Art in Bayesian Changepoint Detection , 2010 .

[33]  Frank Bretz,et al.  Comparison of Methods for the Computation of Multivariate t Probabilities , 2002 .

[34]  Pieter Bastiaan Ober,et al.  Sequential analysis: hypothesis testing and changepoint detection , 2015 .

[35]  Xavier Litrico,et al.  Cyber Security of Water SCADA Systems—Part I: Analysis and Experimentation of Stealthy Deception Attacks , 2013, IEEE Transactions on Control Systems Technology.

[36]  Igor V. Nikiforov,et al.  Non-Bayesian Detection and Detectability of Anomalies From a Few Noisy Tomographic Projections , 2007, IEEE Transactions on Signal Processing.